Trojan horse
 

I got the error to after running a virus scan. Beta 7 installs a program [ad-ware program] that shows up as a trojan horse.

read more about it here, jordan posted more details.
http://bearshare.net/forum/showthrea...&threadid=8300
Becker

FROM WHAT I GAN GATHER DOING THIS WILL COMPLETELY REMOVE THE TROJAN

THERE IS ABSOLUTELY NO GUARANTEE THAT THIS WILL WORK OR THAT IT WON’T DAMEAGE YOU SYSTEM

DO THIS AT YOUR OWN RISK AND BE SHURE TO FOLLOW MY INSTRUCTIONS VERY CAREFULLY
---------------------------

IF YOU HAVE

- Bearshare 2.4.0 Beta 7
- LimeWire 2.02
- Kazaa (unspecified versions)
- Grokster 1.33
- Net2Phone (unspecified versions)

UNINSTALL THEM AND DELETE THE INSTALLATION FILE AND THEIR FOLDER ON YOUR HARD DRIVE

---------------------------

OPEN ANY FOLDER AND GOTO "TOOLS > FOLDER OPTIONS > VIEW" AND CHECK “SHOW HIDDEN FILES AND FOLDERS”

---------------------------

DELETE (IF ANY OF THE FILES ARE INACCESABLE YOU WILL HAVE TO DELETE THEM IN MS-DOS MODE)

(FOLDER) C:\PROGRAM FILES\CLICKTILLUWIN
C:\WINDOWS\START MENU\PROGRAMS\CLICKTILLUWIN\CLICKTILLUWIN.LNK
C:\WINDOWS\DESKTOP\CLICKTILLUWIN.LNK
C:\WINDOWS\DLDER.EXE
(FOLDER NOT EXECUTABLE) C:\WINDOWS\EXPLORER\

---------------------------

GO TO “START > RUN”

TYPE "REGEDIT" WITHOUT QUOTES

PRESS [ENTER]

GOTO
HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS \CURRENT VERSION \RUN

DELETE THE KEY
DLDER = "%WINDOWS%\EXPLORER\EXPLORER.EXE"

well
 

you dont have to uninstall the programs [bearshare, limewire...], they have nothing to do with the trojan horse program. they all can be used with out it. What you should do is update your anti virus and run it. it will detect the trojan and then delete it for you. or a nice peice of software from www.tinysoftware.com will help you out. check them out. :)
Becker

Most virus scan software has not been updated for this new trojan.

Hi I am new here and I have been looking at what every one has been saying about this so called Trojan. I play the ClickTilluWin game and I went to their site and look at what they say. If you look at their terms they tell you that this is being installed on your computer. That doesn't sound like a trojan when they tell you it is there. I also went to McAfee and Norton today to see what they are saying. McAfee says its a program and Norton's page says file not found. So I don't know what is going on but I have the files on my computer and ClickTilluWin says you need them to play the game for updates and other stuff so I am leaving them. Just though you all should know.

Give me one good reason why any legitimate program would name itself explorer.exe.

Then read the description at http://www.europe.f-secure.com/v-descs/dlder.shtml. Sounds a lot more like a trojan now, doesn't it? BTW - Symantec's description is at http://securityresponse.symantec.com...dyn/26696.html. It doesn't say a lot, but does label ClickTilluWin as the W32.DlDer.Trojan (emphasis mine).

This is what's on their site now. They are not calling it a trojon now. Plus they took it off the list of new viruses. If they are still labeling it a trojon then why is it not listed any more in the new virus list?

http://securityresponse.symantec.com...w32.dlder.html

Plus Mcafee has relabeled it.

http://vil.mcafee.com/dispVirus.asp?virus_k=99289&

why have both of them changed what they are calling it and labeling it if it's a trojon?

look at mcafee
 

take a look at the 1st line at McAfee

"This program is not a virus. "

Rather interesting that Symantec labels ClickTilluWin a trojan on one URL and then later claims that it is not malicious on another. And McAfee did the same thing? How often do you see these two companies labeling something a trojan or virus, and then changing their minds? This is the first time that I have seen this happen. Something strange is going on here.

They were probably threatened with legal action by the publisher of the trojan for casting their product in a negative light (and perhaps also by the software vendors (BearShare, Grokster, etc.) who bundled this spyware.) Gator has done this (http://news.cnet.com/news/0-1005-200...6.html?tag=txt), so why not other spyware companies?

Look at the description of ClickTilluWin at the f-secure site, and of Gator at http://www.cexx.org/gator.htm. What would you call these programs? If they are not trojans, then they are becoming very trojan-like, IMHO at least. Do you want programs like these lurking on your system?

Bear in mind (no pun intended) that spyware companies and their customers are not malicious. They are just profit oriented to the point of being unethical.

Why deal with spyware/trojans when you don't have to? Clients such as Xolox, Gnucleus, etc. work just as well as BearShare and LimeWire, maybe better. Why not check them out (they are listed on www.gnutelliums.com) and try them out for yourself?